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RECEIVED 
CENTRAL FAX CENTER 

FEB 2^ 2008 

AMENDMENTS TO THE CLAIMS 

This listing of claims will replace all prior versions, and listings, of claims in 
the subject application: 

Listing of Claims: 

1 , (Currently Amended) A method comprising: 

reading one or more event data, the one or more event data corresponding to an 
event monitored from a system; 

for each event datum, compressing the event datum if the event datum is 
determined to be compressible , said compressing including : 

generating a hash from a value, the value based, at least in part, on one 
or more characteristics of a given event datum of the at least one of 
the one or more event data; 

mapping the hash to a dictionary index in a dictionary, the index 
corresponding to a dictionary entrv: and 

if the dictionary entry corresponds to the given event datum, then 
outputtino the dictionary index: 

creating a processed event record, the processed event record conforming to a 
record format; and 
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storing the one or more event data in the processed event record in accordance 
with the record format. 

2. (Currently Amended) The method of claim 1, wherein said creating a processed 
event record and storing the one or more event data in the processed event 
record in accordance with the record format comprises one of the following: 

if on e or mor e of tho it is determined that none of the one or more event data is 
d e t e rm i n e d not to bo compressible: 

creating an uncompressed event record in an uncompressed record 
format; and 

storing each event datum in an uncompressed format in the 
uncompressed event record; 

if each of the one or more event data is determined to be compressible, then: 

creating a compressed event record in a compressed record format; and 

storing each event datum in a compressed format in the compressed 
event record; and 

if it is determined that some o n o or moro of the one or more event data is 
d e t e rm i ned not 4e-be compressible, then: 

creating a hybrid event record in a hybrid record format; and 
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storing each uncompressed event datum in an uncompressed format in 
the hybrid event record, and storing each compressed event datum 
in a compressed format in the hybrid event record. 

3. (Canceled) 

4. (Canceled) 

5. (Canceled) 

6. (Canceled) 

7. (Currently Amended) The method of claim 1 [[6]], additionally comprising if the 
dictionary entry does not correspond to the given event datum, then outputting 
the given event datum. 

8. (Original) A method comprising: 

reading one or more processed event records from an event buffer, each 
processed event record including one or more processed event data 
corresponding to one or more uncompressed event data; and 

generating one or more client uncompressed event data corresponding to the 

one or more uncompressed event data, said generating one or more client 
uncompressed event data including one of: 

decompressing an event datum if the event datum is in a compressed 
format; and 

outputting an event datum if the event datum is not in a compressed 
format. 
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9. (Original) The method of claim 8, wherein said decompressing the event datum 
comprises: 

mapping a plurality of bits of the event datum to a dictionary index in a dictionary, 
each entry in the address dictionary including a dictionary index and a 
corresponding dictionary entry; and 

using the dictionary entry to obtain the one or more uncompressed event datum, 

10. (Canceled) 

1 1 . (Currently Amended) An apparatus comprising: 
circuitry capable of: 

reading one or more event data, the event data corresponding to an event 
monitored from a system; 

for each event datum, compressing the event datum if the event datum is 
determined to be compressible , said compressing including : 

generating a hash from a value, the value based, at least in part, on one 
or more characteristics of a given event datum of the at least one of 
the one or more event data: 

mapping the hash to a dictionary index in a dictionary, the index 
corresponding to a dictionary entry: and 

if the dicti onary entry corresponds to the given event datum, then 
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outputting the dictionary index: 

creating a processed event record, the processed event record conforming to a 
record format; and 

storing the one or more event data in the processed event record in accordance 
with the record format. 

12. (Canceled) 

13. (Canceled) 

14. (Canceled) 

15. (Canceled) 

16. (Canceled) 

17. (Canceled) 

18. (Canceled) 

1 9. (Currently Amended) A machine-readable medium having stored thereon 
instructions, the instructions when executed by a machine, result In the following: 

reading one or more event data, the event data corresponding to an event 
monitored from a system; 

for each event datum, compressing the event datum if the event datum is 
determined to be compressible , said instructions for compressing 
including ; 

generating a hash from a value, the value based, at least in part, on one 
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or more characteristics of a given event datum of the at least one of 
the one or more event data: 

mapping the hash to a dictionary index in a dictionary, the index 
corresponding to a dictionary entry; and 

if the dictionary entry corresponds to the given event datum, then 
outoutting the dictionary index : 

creating a processed event record, the processed event record conforming to a 
record format; and 

storing the one or more event data in the processed event record in accordance 
with the record format. 

20. (Canceled) 

21. (Canceled) 

22. (Canceled) 

23. (New) The machine-readable medium of claim 19, wherein said instructions for 
creating a processed event record and storing the one or more event data in the 
processed event record in accordance with the record format comprises 
instructions for carrying out one of the following: 

if it is determined that none of the one or more event data is compressible, then 
the instructions comprise result in: 

creating an uncompressed event record in an uncompressed record 
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format; and 

storing each event datum in an uncompressed format in the 
uncompressed event record; 

if each of the one or more event data is determined to be compressible, then, 
then the instructions comprise result in: 

creating a compressed event record in a compressed record format; and 

storing each event datum in a compressed format in the compressed 
event record; and 

if it is determined that some of the one or more event data is not compressible, 
then, then the instructions comprise result in: 

creating a hybrid event record in a hybrid record format; and 

storing each uncompressed event datum in an uncompressed format in 
the hybrid event record, and storing each compressed event datum 
in a compressed format in the hybrid event record, 

24, (New) The method of claim 1 1 , wherein said creating a processed event record 
and storing the one or more event data in the processed event record in 
accordance with the record format comprises one of the following: 

if it is determined that none of the one or more event data is compressible: 
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creating an uncompressed event record in an uncompressed record 
format; and 

storing each event datum in an uncompressed format in the 
uncompressed event record; 

if each of the one or more event data is determined to be compressible, then: 

creating a compressed event record in a compressed record format; and 

storing each event datum in a compressed format in the compressed 
event record; and 

if it is determined that some of the one or more event data is not compressible, 
then: 

creating a hybrid event record in a hybrid record format; and 

storing each uncompressed event datum in an uncompressed format in 
the hybrid event record, and storing each compressed event datum 
in a compressed format in the hybrid event record. 
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AMENDMENTS TO THE DRAWINGS 

The attached sheet of drawings includes changes to FIG. 2 and 12. In 
FIG. 2, "Event Buffer 204" has been amended to "Event Buffer 218". In FIG. 12, 
"1212A" and "1212N" have been amended so that the reference numerals are 
legible. 

Attachment: Replacement Sheet 2, Replacement Sheet 12, Annotated Marked- 
Up Drawings for FIG. 2, and Annotated Marked-Up Drawings for FIG. 12. 



Utility Patent Application 



Docket No.: 42390P17252 
Application No.: 10/748,875 



15 



PAGE 20/28 * RCVD AT 2/26/2008 2:39:52 AM [Eastern Standard Time] * SVR:llSPT0-ff XRF-5/22 * DNIS:2738300 * CSID:9494980601 * DURATION (mm-ss):04-28 



